The vulnerability is a Cross‑Site Request Forgery (CSRF) that allows an attacker to inject arbitrary scripts into the plugin’s data store, resulting in stored cross‑site scripting. The attacker can exploit the flaw to execute malicious code in the browsers of users who view the affected sitemap pages, potentially leading to session hijacking, defacement, or remote code execution on the client side. This weakness is classified as CWE‑352.

Any WordPress site running the WP Html Page Sitemap plugin version 2.2 or earlier is impacted. The plugin is distributed by the vendor pa1. No specific sub‑versions are enumerated, so all releases up to 2.2 are affected, including 2.0, 2.1, and 2.2.

The CVSS score is 7.1, indicating a high severity. The EPSS score of < 1% shows that the probability of a real‑world exploit is currently very low, and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector requires a logged‑in user or an administrative credential to perform a CSRF request, which then writes malicious script data to the sitemap store that is executed when the sitemap is rendered.